Extracted

• • Target
    daad6bbfc12991b5f327755123cb4b48
  • Size 11.7MB
  • SHA256 ca42af334909a2296e1a3ef8707988abba34633858c1b5613b3d6354e66eb0db
  • MD5 daad6bbfc12991b5f327755123cb4b48
  • SHA1 da32a326b2a616b1ead71b2b804ac5c2af70aa81
  • SHA512 1a197f619d8fbc8ce21f93400fbed79e9f50d37751e734c7fd1d52d7d1005307b384ff3ff6f92c933953c393adf1a490b5c103fe128c717f0b213efe0b50c5c2
  • SSDEEP 24576:+gdy5yNM4444444444444444444444444444444444444444444444444444444s:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2